Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 23:37
Static task
static1
Behavioral task
behavioral1
Sample
4fcca8a0545d186f460ac10886c46cd42fbef9e343d9e9d997c13820bccc7a87.exe
Resource
win7-20240903-en
General
-
Target
4fcca8a0545d186f460ac10886c46cd42fbef9e343d9e9d997c13820bccc7a87.exe
-
Size
453KB
-
MD5
afefe191cfec1baabd209d2703abb81a
-
SHA1
5858b3c6b969b349839f60e270d866c8b22d53f9
-
SHA256
4fcca8a0545d186f460ac10886c46cd42fbef9e343d9e9d997c13820bccc7a87
-
SHA512
7dd47d17caa2f9d66150b49d02fddd182bb71207c5b9dbc08d7372b02dd26de526430aefd61555d45a6f526e9f96c4a58e4554b9fdaac83ad41bb65f979a7424
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeH:q7Tc2NYHUrAwfMp3CDH
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
Processes:
resource yara_rule behavioral1/memory/2860-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/284-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-132-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/836-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-168-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1788-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-189-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/292-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/800-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-279-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/880-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/880-334-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2272-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/304-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-435-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/776-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-459-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2408-473-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2028-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-553-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2360-728-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1920-776-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-777-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2544-804-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/376-835-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2064-843-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2880-1004-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2484-1011-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1148-1144-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vvpjj.exejjjjp.exe9rxxxrx.exe9vvjd.exexxfxlff.exehnnbnh.exexxxrlxx.exehhnhth.exehbthtb.exe9xfllfr.exerrlxxlf.exepvvjv.exelxfrlxr.exentttht.exebbnbht.exebhbthn.exehhtbbn.exedpvjd.exehtthtb.exeddpvj.exebbthhn.exejddjd.exe3hhnth.exe5ppjp.exefllrflr.exevdpvp.exenbbttn.exevpdjv.exebttbnn.exevpjvj.exe5nhnhn.exe1flxxrr.exebbbthn.exexxxllrf.exexrlxlrl.exe9tthth.exejdpdd.exexfllfxr.exebbthth.exehbbhtb.exejdvdv.exe9fxlrxr.exe7htbbb.exevdjvj.exevpjpd.exelrlrflf.exetnbbhn.exejpvvp.exepppjv.exelrxllll.exehhtnbn.exe3djjv.exerffrlxl.exetththt.exeppdjv.exexfflxfx.exerlflrfx.exethhtht.exevddpj.exe9rlrxlf.exenbnhbt.exebtthtb.exepvpdd.exefflrlxl.exepid process 2908 vvpjj.exe 1648 jjjjp.exe 2348 9rxxxrx.exe 2076 9vvjd.exe 284 xxfxlff.exe 1536 hnnbnh.exe 2232 xxxrlxx.exe 2632 hhnhth.exe 2816 hbthtb.exe 2616 9xfllfr.exe 2720 rrlxxlf.exe 2540 pvvjv.exe 2504 lxfrlxr.exe 2532 ntttht.exe 836 bbnbht.exe 1488 bhbthn.exe 2404 hhtbbn.exe 1788 dpvjd.exe 1920 htthtb.exe 292 ddpvj.exe 2308 bbthhn.exe 800 jddjd.exe 1640 3hhnth.exe 1052 5ppjp.exe 1712 fllrflr.exe 2132 vdpvp.exe 1896 nbbttn.exe 892 vpdjv.exe 2584 bttbnn.exe 2120 vpjvj.exe 3016 5nhnhn.exe 880 1flxxrr.exe 2872 bbbthn.exe 1552 xxxllrf.exe 1580 xrlxlrl.exe 2448 9tthth.exe 2272 jdpdd.exe 2568 xfllfxr.exe 304 bbthth.exe 2112 hbbhtb.exe 2316 jdvdv.exe 1536 9fxlrxr.exe 2576 7htbbb.exe 2708 vdjvj.exe 2632 vpjpd.exe 2764 lrlrflf.exe 2804 tnbbhn.exe 2920 jpvvp.exe 2744 pppjv.exe 2500 lrxllll.exe 2480 hhtnbn.exe 2904 3djjv.exe 1380 rffrlxl.exe 776 tththt.exe 1744 ppdjv.exe 1908 xfflxfx.exe 2408 rlflrfx.exe 1700 thhtht.exe 2028 vddpj.exe 340 9rlrxlf.exe 1284 nbnhbt.exe 748 btthtb.exe 2472 pvpdd.exe 2776 fflrlxl.exe -
Processes:
resource yara_rule behavioral1/memory/2860-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/284-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/292-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-327-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2272-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/304-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-435-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/776-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-728-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1028-729-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-756-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1920-776-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-804-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-1012-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-1038-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
llxfrxf.exeffxrrxf.exexxlrxlx.exehhbtth.exedvpjp.exebttbhb.exehhnbbn.exerlflxxl.exenbnhbt.exevjppv.exenhbtbb.exe7jjjp.exelfxrxxl.exedjddj.exevpdjv.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4fcca8a0545d186f460ac10886c46cd42fbef9e343d9e9d997c13820bccc7a87.exevvpjj.exejjjjp.exe9rxxxrx.exe9vvjd.exexxfxlff.exehnnbnh.exexxxrlxx.exehhnhth.exehbthtb.exe9xfllfr.exerrlxxlf.exepvvjv.exelxfrlxr.exentttht.exebbnbht.exedescription pid process target process PID 2860 wrote to memory of 2908 2860 4fcca8a0545d186f460ac10886c46cd42fbef9e343d9e9d997c13820bccc7a87.exe vvpjj.exe PID 2860 wrote to memory of 2908 2860 4fcca8a0545d186f460ac10886c46cd42fbef9e343d9e9d997c13820bccc7a87.exe vvpjj.exe PID 2860 wrote to memory of 2908 2860 4fcca8a0545d186f460ac10886c46cd42fbef9e343d9e9d997c13820bccc7a87.exe vvpjj.exe PID 2860 wrote to memory of 2908 2860 4fcca8a0545d186f460ac10886c46cd42fbef9e343d9e9d997c13820bccc7a87.exe vvpjj.exe PID 2908 wrote to memory of 1648 2908 vvpjj.exe jjjjp.exe PID 2908 wrote to memory of 1648 2908 vvpjj.exe jjjjp.exe PID 2908 wrote to memory of 1648 2908 vvpjj.exe jjjjp.exe PID 2908 wrote to memory of 1648 2908 vvpjj.exe jjjjp.exe PID 1648 wrote to memory of 2348 1648 jjjjp.exe 9rxxxrx.exe PID 1648 wrote to memory of 2348 1648 jjjjp.exe 9rxxxrx.exe PID 1648 wrote to memory of 2348 1648 jjjjp.exe 9rxxxrx.exe PID 1648 wrote to memory of 2348 1648 jjjjp.exe 9rxxxrx.exe PID 2348 wrote to memory of 2076 2348 9rxxxrx.exe 9vvjd.exe PID 2348 wrote to memory of 2076 2348 9rxxxrx.exe 9vvjd.exe PID 2348 wrote to memory of 2076 2348 9rxxxrx.exe 9vvjd.exe PID 2348 wrote to memory of 2076 2348 9rxxxrx.exe 9vvjd.exe PID 2076 wrote to memory of 284 2076 9vvjd.exe xxfxlff.exe PID 2076 wrote to memory of 284 2076 9vvjd.exe xxfxlff.exe PID 2076 wrote to memory of 284 2076 9vvjd.exe xxfxlff.exe PID 2076 wrote to memory of 284 2076 9vvjd.exe xxfxlff.exe PID 284 wrote to memory of 1536 284 xxfxlff.exe hnnbnh.exe PID 284 wrote to memory of 1536 284 xxfxlff.exe hnnbnh.exe PID 284 wrote to memory of 1536 284 xxfxlff.exe hnnbnh.exe PID 284 wrote to memory of 1536 284 xxfxlff.exe hnnbnh.exe PID 1536 wrote to memory of 2232 1536 hnnbnh.exe xxxrlxx.exe PID 1536 wrote to memory of 2232 1536 hnnbnh.exe xxxrlxx.exe PID 1536 wrote to memory of 2232 1536 hnnbnh.exe xxxrlxx.exe PID 1536 wrote to memory of 2232 1536 hnnbnh.exe xxxrlxx.exe PID 2232 wrote to memory of 2632 2232 xxxrlxx.exe hhnhth.exe PID 2232 wrote to memory of 2632 2232 xxxrlxx.exe hhnhth.exe PID 2232 wrote to memory of 2632 2232 xxxrlxx.exe hhnhth.exe PID 2232 wrote to memory of 2632 2232 xxxrlxx.exe hhnhth.exe PID 2632 wrote to memory of 2816 2632 hhnhth.exe hbthtb.exe PID 2632 wrote to memory of 2816 2632 hhnhth.exe hbthtb.exe PID 2632 wrote to memory of 2816 2632 hhnhth.exe hbthtb.exe PID 2632 wrote to memory of 2816 2632 hhnhth.exe hbthtb.exe PID 2816 wrote to memory of 2616 2816 hbthtb.exe 9xfllfr.exe PID 2816 wrote to memory of 2616 2816 hbthtb.exe 9xfllfr.exe PID 2816 wrote to memory of 2616 2816 hbthtb.exe 9xfllfr.exe PID 2816 wrote to memory of 2616 2816 hbthtb.exe 9xfllfr.exe PID 2616 wrote to memory of 2720 2616 9xfllfr.exe rrlxxlf.exe PID 2616 wrote to memory of 2720 2616 9xfllfr.exe rrlxxlf.exe PID 2616 wrote to memory of 2720 2616 9xfllfr.exe rrlxxlf.exe PID 2616 wrote to memory of 2720 2616 9xfllfr.exe rrlxxlf.exe PID 2720 wrote to memory of 2540 2720 rrlxxlf.exe pvvjv.exe PID 2720 wrote to memory of 2540 2720 rrlxxlf.exe pvvjv.exe PID 2720 wrote to memory of 2540 2720 rrlxxlf.exe pvvjv.exe PID 2720 wrote to memory of 2540 2720 rrlxxlf.exe pvvjv.exe PID 2540 wrote to memory of 2504 2540 pvvjv.exe lxfrlxr.exe PID 2540 wrote to memory of 2504 2540 pvvjv.exe lxfrlxr.exe PID 2540 wrote to memory of 2504 2540 pvvjv.exe lxfrlxr.exe PID 2540 wrote to memory of 2504 2540 pvvjv.exe lxfrlxr.exe PID 2504 wrote to memory of 2532 2504 lxfrlxr.exe ntttht.exe PID 2504 wrote to memory of 2532 2504 lxfrlxr.exe ntttht.exe PID 2504 wrote to memory of 2532 2504 lxfrlxr.exe ntttht.exe PID 2504 wrote to memory of 2532 2504 lxfrlxr.exe ntttht.exe PID 2532 wrote to memory of 836 2532 ntttht.exe bbnbht.exe PID 2532 wrote to memory of 836 2532 ntttht.exe bbnbht.exe PID 2532 wrote to memory of 836 2532 ntttht.exe bbnbht.exe PID 2532 wrote to memory of 836 2532 ntttht.exe bbnbht.exe PID 836 wrote to memory of 1488 836 bbnbht.exe bhbthn.exe PID 836 wrote to memory of 1488 836 bbnbht.exe bhbthn.exe PID 836 wrote to memory of 1488 836 bbnbht.exe bhbthn.exe PID 836 wrote to memory of 1488 836 bbnbht.exe bhbthn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fcca8a0545d186f460ac10886c46cd42fbef9e343d9e9d997c13820bccc7a87.exe"C:\Users\Admin\AppData\Local\Temp\4fcca8a0545d186f460ac10886c46cd42fbef9e343d9e9d997c13820bccc7a87.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\vvpjj.exec:\vvpjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\jjjjp.exec:\jjjjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\9rxxxrx.exec:\9rxxxrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\9vvjd.exec:\9vvjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\xxfxlff.exec:\xxfxlff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:284 -
\??\c:\hnnbnh.exec:\hnnbnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\xxxrlxx.exec:\xxxrlxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\hhnhth.exec:\hhnhth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\hbthtb.exec:\hbthtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\9xfllfr.exec:\9xfllfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\rrlxxlf.exec:\rrlxxlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\pvvjv.exec:\pvvjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\lxfrlxr.exec:\lxfrlxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\ntttht.exec:\ntttht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\bbnbht.exec:\bbnbht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\bhbthn.exec:\bhbthn.exe17⤵
- Executes dropped EXE
PID:1488 -
\??\c:\hhtbbn.exec:\hhtbbn.exe18⤵
- Executes dropped EXE
PID:2404 -
\??\c:\dpvjd.exec:\dpvjd.exe19⤵
- Executes dropped EXE
PID:1788 -
\??\c:\htthtb.exec:\htthtb.exe20⤵
- Executes dropped EXE
PID:1920 -
\??\c:\ddpvj.exec:\ddpvj.exe21⤵
- Executes dropped EXE
PID:292 -
\??\c:\bbthhn.exec:\bbthhn.exe22⤵
- Executes dropped EXE
PID:2308 -
\??\c:\jddjd.exec:\jddjd.exe23⤵
- Executes dropped EXE
PID:800 -
\??\c:\3hhnth.exec:\3hhnth.exe24⤵
- Executes dropped EXE
PID:1640 -
\??\c:\5ppjp.exec:\5ppjp.exe25⤵
- Executes dropped EXE
PID:1052 -
\??\c:\fllrflr.exec:\fllrflr.exe26⤵
- Executes dropped EXE
PID:1712 -
\??\c:\vdpvp.exec:\vdpvp.exe27⤵
- Executes dropped EXE
PID:2132 -
\??\c:\nbbttn.exec:\nbbttn.exe28⤵
- Executes dropped EXE
PID:1896 -
\??\c:\vpdjv.exec:\vpdjv.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:892 -
\??\c:\bttbnn.exec:\bttbnn.exe30⤵
- Executes dropped EXE
PID:2584 -
\??\c:\vpjvj.exec:\vpjvj.exe31⤵
- Executes dropped EXE
PID:2120 -
\??\c:\5nhnhn.exec:\5nhnhn.exe32⤵
- Executes dropped EXE
PID:3016 -
\??\c:\1flxxrr.exec:\1flxxrr.exe33⤵
- Executes dropped EXE
PID:880 -
\??\c:\bbbthn.exec:\bbbthn.exe34⤵
- Executes dropped EXE
PID:2872 -
\??\c:\xxxllrf.exec:\xxxllrf.exe35⤵
- Executes dropped EXE
PID:1552 -
\??\c:\xrlxlrl.exec:\xrlxlrl.exe36⤵
- Executes dropped EXE
PID:1580 -
\??\c:\9tthth.exec:\9tthth.exe37⤵
- Executes dropped EXE
PID:2448 -
\??\c:\jdpdd.exec:\jdpdd.exe38⤵
- Executes dropped EXE
PID:2272 -
\??\c:\xfllfxr.exec:\xfllfxr.exe39⤵
- Executes dropped EXE
PID:2568 -
\??\c:\bbthth.exec:\bbthth.exe40⤵
- Executes dropped EXE
PID:304 -
\??\c:\hbbhtb.exec:\hbbhtb.exe41⤵
- Executes dropped EXE
PID:2112 -
\??\c:\jdvdv.exec:\jdvdv.exe42⤵
- Executes dropped EXE
PID:2316 -
\??\c:\9fxlrxr.exec:\9fxlrxr.exe43⤵
- Executes dropped EXE
PID:1536 -
\??\c:\7htbbb.exec:\7htbbb.exe44⤵
- Executes dropped EXE
PID:2576 -
\??\c:\vdjvj.exec:\vdjvj.exe45⤵
- Executes dropped EXE
PID:2708 -
\??\c:\vpjpd.exec:\vpjpd.exe46⤵
- Executes dropped EXE
PID:2632 -
\??\c:\lrlrflf.exec:\lrlrflf.exe47⤵
- Executes dropped EXE
PID:2764 -
\??\c:\tnbbhn.exec:\tnbbhn.exe48⤵
- Executes dropped EXE
PID:2804 -
\??\c:\jpvvp.exec:\jpvvp.exe49⤵
- Executes dropped EXE
PID:2920 -
\??\c:\pppjv.exec:\pppjv.exe50⤵
- Executes dropped EXE
PID:2744 -
\??\c:\lrxllll.exec:\lrxllll.exe51⤵
- Executes dropped EXE
PID:2500 -
\??\c:\hhtnbn.exec:\hhtnbn.exe52⤵
- Executes dropped EXE
PID:2480 -
\??\c:\3djjv.exec:\3djjv.exe53⤵
- Executes dropped EXE
PID:2904 -
\??\c:\rffrlxl.exec:\rffrlxl.exe54⤵
- Executes dropped EXE
PID:1380 -
\??\c:\tththt.exec:\tththt.exe55⤵
- Executes dropped EXE
PID:776 -
\??\c:\ppdjv.exec:\ppdjv.exe56⤵
- Executes dropped EXE
PID:1744 -
\??\c:\xfflxfx.exec:\xfflxfx.exe57⤵
- Executes dropped EXE
PID:1908 -
\??\c:\rlflrfx.exec:\rlflrfx.exe58⤵
- Executes dropped EXE
PID:2408 -
\??\c:\thhtht.exec:\thhtht.exe59⤵
- Executes dropped EXE
PID:1700 -
\??\c:\vddpj.exec:\vddpj.exe60⤵
- Executes dropped EXE
PID:2028 -
\??\c:\9rlrxlf.exec:\9rlrxlf.exe61⤵
- Executes dropped EXE
PID:340 -
\??\c:\nbnhbt.exec:\nbnhbt.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1284 -
\??\c:\btthtb.exec:\btthtb.exe63⤵
- Executes dropped EXE
PID:748 -
\??\c:\pvpdd.exec:\pvpdd.exe64⤵
- Executes dropped EXE
PID:2472 -
\??\c:\fflrlxl.exec:\fflrlxl.exe65⤵
- Executes dropped EXE
PID:2776 -
\??\c:\nntbhn.exec:\nntbhn.exe66⤵PID:2320
-
\??\c:\5ppvv.exec:\5ppvv.exe67⤵PID:2788
-
\??\c:\ddpdd.exec:\ddpdd.exe68⤵PID:1764
-
\??\c:\lllfxll.exec:\lllfxll.exe69⤵PID:1524
-
\??\c:\ntthhb.exec:\ntthhb.exe70⤵PID:2580
-
\??\c:\9dvjv.exec:\9dvjv.exe71⤵PID:3004
-
\??\c:\jpvdp.exec:\jpvdp.exe72⤵PID:1896
-
\??\c:\rrxlflf.exec:\rrxlflf.exe73⤵PID:2216
-
\??\c:\hhnbbn.exec:\hhnbbn.exe74⤵
- System Location Discovery: System Language Discovery
PID:2584 -
\??\c:\ppdvv.exec:\ppdvv.exe75⤵PID:2144
-
\??\c:\xxxlflf.exec:\xxxlflf.exe76⤵PID:2924
-
\??\c:\hnthth.exec:\hnthth.exe77⤵PID:2208
-
\??\c:\btthht.exec:\btthht.exe78⤵PID:392
-
\??\c:\pjdjv.exec:\pjdjv.exe79⤵PID:492
-
\??\c:\3xrfrxf.exec:\3xrfrxf.exe80⤵PID:2812
-
\??\c:\bbthbh.exec:\bbthbh.exe81⤵PID:2088
-
\??\c:\nttnhh.exec:\nttnhh.exe82⤵PID:1648
-
\??\c:\jjdpd.exec:\jjdpd.exe83⤵PID:2768
-
\??\c:\rrrfxfl.exec:\rrrfxfl.exe84⤵PID:2092
-
\??\c:\9nbtbn.exec:\9nbtbn.exe85⤵PID:1752
-
\??\c:\hnhnht.exec:\hnhnht.exe86⤵PID:2056
-
\??\c:\vvdpp.exec:\vvdpp.exe87⤵PID:2296
-
\??\c:\lrrrflx.exec:\lrrrflx.exe88⤵PID:2340
-
\??\c:\7nbnbn.exec:\7nbnbn.exe89⤵PID:2612
-
\??\c:\ttnntt.exec:\ttnntt.exe90⤵PID:2948
-
\??\c:\pdpvj.exec:\pdpvj.exe91⤵PID:2680
-
\??\c:\7lrffrl.exec:\7lrffrl.exe92⤵PID:2732
-
\??\c:\rlxlrxr.exec:\rlxlrxr.exe93⤵PID:2644
-
\??\c:\3btthb.exec:\3btthb.exe94⤵PID:2572
-
\??\c:\1dpjp.exec:\1dpjp.exe95⤵PID:1392
-
\??\c:\jdjdp.exec:\jdjdp.exe96⤵PID:2648
-
\??\c:\3xxfllf.exec:\3xxfllf.exe97⤵PID:2692
-
\??\c:\tttnhn.exec:\tttnhn.exe98⤵PID:2504
-
\??\c:\1dvdj.exec:\1dvdj.exe99⤵PID:2360
-
\??\c:\5jjjv.exec:\5jjjv.exe100⤵PID:1028
-
\??\c:\lllrlxr.exec:\lllrlxr.exe101⤵PID:836
-
\??\c:\bhtbnn.exec:\bhtbnn.exe102⤵PID:2412
-
\??\c:\jpjdd.exec:\jpjdd.exe103⤵PID:1928
-
\??\c:\ffrffrf.exec:\ffrffrf.exe104⤵PID:2452
-
\??\c:\ttthhh.exec:\ttthhh.exe105⤵PID:1064
-
\??\c:\5nbhtb.exec:\5nbhtb.exe106⤵PID:1920
-
\??\c:\5ffflrf.exec:\5ffflrf.exe107⤵PID:1292
-
\??\c:\ttnbhn.exec:\ttnbhn.exe108⤵PID:316
-
\??\c:\9jdjd.exec:\9jdjd.exe109⤵PID:1636
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe110⤵PID:2212
-
\??\c:\3fffllx.exec:\3fffllx.exe111⤵PID:2544
-
\??\c:\7hbhbn.exec:\7hbhbn.exe112⤵PID:2320
-
\??\c:\7pdjv.exec:\7pdjv.exe113⤵PID:1180
-
\??\c:\dddvp.exec:\dddvp.exe114⤵PID:1960
-
\??\c:\xxxflxf.exec:\xxxflxf.exe115⤵PID:376
-
\??\c:\hhhbbb.exec:\hhhbbb.exe116⤵PID:2064
-
\??\c:\vpdpd.exec:\vpdpd.exe117⤵PID:1624
-
\??\c:\jvjpj.exec:\jvjpj.exe118⤵PID:2980
-
\??\c:\xxrxrrf.exec:\xxrxrrf.exe119⤵PID:272
-
\??\c:\5nbbnn.exec:\5nbbnn.exe120⤵PID:2820
-
\??\c:\btntnt.exec:\btntnt.exe121⤵PID:2828
-
\??\c:\vvpdd.exec:\vvpdd.exe122⤵PID:2676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-